SF Guardrail

Salesforce-aware safety hooks — file protection policies, dangerous-command gating, org-aware confirmation, and native high-value mutation mediation

What it does

Salesforce-aware safety layer for pi: file-protection policies, AST-matched command gating, org-aware confirmation on production deploys/Apex/DML/destructive REST, native high-value mutation mediation, plus a once-per-session prompt-injection that teaches the LLM the gating categories and validate-first workflow.

Start

Open the extension from its primary command:

/sf-guardrail

Open its Manager detail or change its package state with:

/sf-pi open sf-guardrail
/sf-pi enable sf-guardrail
/sf-pi disable sf-guardrail

Safety notes

• Fail-closed in headless mode unless SF_GUARDRAIL_ALLOW_HEADLESS=1.
• Every block / allow / confirm decision is persisted as an audit entry.
• Power Tool Mode can persistently auto-approve selected confirm-class decisions; production/unknown org auto-approve is a separate opt-in and hard blocks are never bypassed.
• Operator auto-approve env mode is process-scoped, audited, and does not bypass hard blocks.
• Known high-value native tool mutations are mediated before execution through the same Safety Kernel and HITL path, including first-slice AgentScript lifecycle, Data 360, Apex, Slack Canvas, and SF Browser commit surfaces.
• alwaysActive=false but disabling removes the safety layer entirely; the manager surfaces this clearly.

Exact reference

Show commands, tools, providers, and hooks

• Extension id: sf-guardrail
• Intent: Work safely
• Category: Safety
• Maturity: stable
• Default state: on
• Commands: /sf-guardrail
• LLM tools: none
• Providers: none
• Events/hooks: session_start, session_tree, before_agent_start, tool_call, context

For contributors

• Full extension README
• Source folder
• Agent editing rules
• Domain glossary

Troubleshooting

See the Troubleshooting section in the full README for extension-specific recovery steps.